@dollhousemcp/mcp-server 2.0.20 → 2.0.21

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [2.0.21] - 2026-04-16
+
+- Sanitize OAuth and PAT helper logging to restore SonarCloud security quality
+
 ## [2.0.20] - 2026-04-16
 
 Point release for console leader bind authority and follower registration recovery.

package/dist/generated/version.d.ts

@@ -2,8 +2,8 @@
  * Auto-generated file - DO NOT EDIT
  * Generated at build time by scripts/generate-version.js
  */
-export declare const PACKAGE_VERSION = "2.0.20";
-export declare const BUILD_TIMESTAMP = "2026-04-16T14:53:41.093Z";
+export declare const PACKAGE_VERSION = "2.0.21";
+export declare const BUILD_TIMESTAMP = "2026-04-16T15:35:15.005Z";
 export declare const BUILD_TYPE: 'npm' | 'git';
 export declare const PACKAGE_NAME = "@dollhousemcp/mcp-server";
 //# sourceMappingURL=version.d.ts.map

package/dist/generated/version.js

@@ -2,8 +2,8 @@
  * Auto-generated file - DO NOT EDIT
  * Generated at build time by scripts/generate-version.js
  */
-export const PACKAGE_VERSION = '2.0.20';
-export const BUILD_TIMESTAMP = '2026-04-16T14:53:41.093Z';
+export const PACKAGE_VERSION = '2.0.21';
+export const BUILD_TIMESTAMP = '2026-04-16T15:35:15.005Z';
 export const BUILD_TYPE = 'npm';
 export const PACKAGE_NAME = '@dollhousemcp/mcp-server';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQvdmVyc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFFSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRywwQkFBMEIsQ0FBQztBQUMxRCxNQUFNLENBQUMsTUFBTSxVQUFVLEdBQWtCLEtBQUssQ0FBQztBQUMvQyxNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsMEJBQTBCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEF1dG8tZ2VuZXJhdGVkIGZpbGUgLSBETyBOT1QgRURJVFxuICogR2VuZXJhdGVkIGF0IGJ1aWxkIHRpbWUgYnkgc2NyaXB0cy9nZW5lcmF0ZS12ZXJzaW9uLmpzXG4gKi9cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9ICcyLjAuMjAnO1xuZXhwb3J0IGNvbnN0IEJVSUxEX1RJTUVTVEFNUCA9ICcyMDI2LTA0LTE2VDE0OjUzOjQxLjA5M1onO1xuZXhwb3J0IGNvbnN0IEJVSUxEX1RZUEU6ICducG0nIHwgJ2dpdCcgPSAnbnBtJztcbmV4cG9ydCBjb25zdCBQQUNLQUdFX05BTUUgPSAnQGRvbGxob3VzZW1jcC9tY3Atc2VydmVyJztcbiJdfQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9nZW5lcmF0ZWQvdmVyc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7O0dBR0c7QUFFSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDO0FBQ3hDLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRywwQkFBMEIsQ0FBQztBQUMxRCxNQUFNLENBQUMsTUFBTSxVQUFVLEdBQWtCLEtBQUssQ0FBQztBQUMvQyxNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsMEJBQTBCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEF1dG8tZ2VuZXJhdGVkIGZpbGUgLSBETyBOT1QgRURJVFxuICogR2VuZXJhdGVkIGF0IGJ1aWxkIHRpbWUgYnkgc2NyaXB0cy9nZW5lcmF0ZS12ZXJzaW9uLmpzXG4gKi9cblxuZXhwb3J0IGNvbnN0IFBBQ0tBR0VfVkVSU0lPTiA9ICcyLjAuMjEnO1xuZXhwb3J0IGNvbnN0IEJVSUxEX1RJTUVTVEFNUCA9ICcyMDI2LTA0LTE2VDE1OjM1OjE1LjAwNVonO1xuZXhwb3J0IGNvbnN0IEJVSUxEX1RZUEU6ICducG0nIHwgJ2dpdCcgPSAnbnBtJztcbmV4cG9ydCBjb25zdCBQQUNLQUdFX05BTUUgPSAnQGRvbGxob3VzZW1jcC9tY3Atc2VydmVyJztcbiJdfQ==

package/oauth-helper.mjs

@@ -110,7 +110,7 @@ async function pollGitHub(deviceCode, clientId) {
     const data = await response.json();
     return data;
   } catch (error) {
-    await log(`Network error polling GitHub: ${error.message}`);
+    await log('Network error polling GitHub');
     throw error;
   }
 }
@@ -130,8 +130,8 @@ async function storeToken(token) {
     await TokenManager.storeGitHubToken(token);
     await log('Token stored successfully using TokenManager');
     return true;
-  } catch (error) {
-    await log(`Failed to store token using TokenManager: ${error.message}`);
+  } catch {
+    await log('Failed to store token using TokenManager');
     
     // Fallback: Write to a temporary file for the MCP server to pick up
     try {
@@ -154,10 +154,10 @@ async function storeToken(token) {
       // Verify file permissions
       await fs.chmod(tempTokenFile, 0o600);
       
-      await log(`Token written to fallback file with secure permissions`);
+      await log('Token written to fallback file with secure permissions');
       return true;
     } catch (fallbackError) {
-      await log(`Fallback storage also failed: ${fallbackError.message}`);
+      await log('Fallback storage also failed');
       throw fallbackError;
     }
   }
@@ -192,14 +192,14 @@ async function writePidFile() {
     await fs.mkdir(pidDir, { recursive: true, mode: 0o700 });
     await fs.writeFile(pidFile, process.pid.toString(), { mode: 0o600 });
     await log(`PID file written: ${pidFile}`);
-  } catch (error) {
-    await log(`Failed to write PID file: ${error.message}`);
+  } catch {
+    await log('Failed to write PID file');
   }
 }
 
 async function main() {
   await log(`[START] OAuth helper started - PID: ${process.pid}`);
-  await log(`[CONFIG] Device code: ${deviceCode.substring(0, 2)}****`); // More aggressive truncation
+  await log('[CONFIG] Device code received');
   await log(`[CONFIG] Poll interval: ${pollInterval}s, Expires in: ${expiresIn}s`);
   await log(`[CONFIG] Node version: ${process.version}`);
   await log(`[CONFIG] Platform: ${process.platform}`);
@@ -278,9 +278,9 @@ async function main() {
             process.exit(1);
             
           default:
-            await log(`OAUTH_HELPER_276: Unknown error from GitHub: ${response.error}`);
-            await log(`[ERROR] Error description: ${response.error_description}`);
-            console.error(`OAUTH_UNKNOWN_RESPONSE: Unknown error '${response.error}' at line 276`);
+            await log('OAUTH_HELPER_276: Unknown error from GitHub during device flow polling');
+            await log('[ERROR] GitHub returned an unrecognized OAuth polling response');
+            console.error('OAUTH_UNKNOWN_RESPONSE: Unknown GitHub OAuth response at line 276');
         }
       } else if (response.access_token) {
         // Success! We got the token
@@ -309,7 +309,7 @@ async function main() {
         consecutiveErrors = 0;
       }
     } catch (error) {
-      await log(`[ERROR] Polling error: ${error.message}`);
+      await log('[ERROR] Polling error');
       
       // Classify error types
       const isNetworkError = error.message && (
@@ -333,8 +333,8 @@ async function main() {
         }
       } else {
         // Non-network error, likely fatal
-        await log(`OAUTH_HELPER_330: Non-recoverable error: ${error.message}`);
-        console.error(`OAUTH_FATAL_ERROR: Non-recoverable error at line 330 - ${error.message}`);
+        await log('OAUTH_HELPER_330: Non-recoverable error');
+        console.error('OAUTH_FATAL_ERROR: Non-recoverable error at line 330');
         clearInterval(heartbeatInterval);
         await cleanupPidFile();
         process.exit(1);
@@ -355,9 +355,9 @@ async function main() {
 }
 
 // Run the main function
-main().catch(async (error) => {
-  await log(`Fatal error: ${error.message}`);
-  console.error('Fatal error in OAuth helper:', error);
+main().catch(async () => {
+  await log('Fatal error');
+  console.error('Fatal error in OAuth helper');
   await cleanupPidFile();
   process.exit(1);
-});
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dollhousemcp/mcp-server",
-  "version": "2.0.20",
+  "version": "2.0.21",
   "description": "DollhouseMCP - A Model Context Protocol (MCP) server that enables dynamic AI persona management from markdown files, allowing Claude and other compatible AI assistants to activate and switch between different behavioral personas.",
   "type": "module",
   "main": "dist/index.js",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.DollhouseMCP/mcp-server",
   "title": "DollhouseMCP",
   "description": "OSS to create Personas, Skills, Templates, Agents, and Memories to customize your AI experience.",
-  "version": "2.0.20",
+  "version": "2.0.21",
   "homepage": "https://dollhousemcp.com",
   "repository": {
     "type": "git",
@@ -29,7 +29,7 @@
     {
       "registryType": "npm",
       "identifier": "@dollhousemcp/mcp-server",
-      "version": "2.0.20",
+      "version": "2.0.21",
       "transport": {
         "type": "stdio"
       }